Patent Grant
10447610
Modern computer systems employ a combination of local and remote systems, typically distributing resources, processing, storage and other such computer system capabilities across a variety of computer system entities and sending requests between the system entities. Because of the distributed nature of such systems, resources created in one region may be required in another region, and access to such remote system resources can be problematic, often resulting in long latencies for responses, frequent disconnects and loss of system availability. Because different remote system elements may have different authorization and authentication systems, administrators of such systems may have to manage a plurality of accounts and credentials to allow users access to the resources provided by the distributed system, also leading to maintenance issues, additional costs and potential security issues.
Various embodiments in accordance with the present disclosure will be described with reference to the drawings, in which:
In the following description, various embodiments will be described. For purposes of explanation, specific configurations and details are set forth in order to provide a thorough understanding of the embodiments. However, it will also be apparent to one skilled in the art that the embodiments may be practiced without the specific details. Furthermore, well-known features may be omitted or simplified in order not to obscure the embodiment being described.
Techniques described and suggested herein include methods, systems and processes for managing access to and/or operations on resources on distributed and/or virtualized computer systems and executable code operating thereon. In particular, techniques are disclosed for utilizing system capabilities to facilitate and manage access to system resources such as directory services, web services, directories, file systems, files, users, security policies, network resources, applications, system storage and the like, by and for computer system entities including, but not limited to, users, services, processes, applications, client devices, guest operating systems and/or other such computer system entities. A distributed and/or virtualized computer system may benefit from efficient management of local and/or remote system resources in order to facilitate better system performance, better access to system resources, higher availability of system resources, better data security, better user security and/or other such system benefits.
A distributed and/or virtualized computer system may implement one or more computer system services and may have one or more system resources such as user resources, policy resources, network resources, storage resources and/or other such resources associated with the computer system and, in some embodiments, located in one or more datacenters. The computer system services and the system resources such as user resources, policy resources, network resources, storage resources and/or other such resources associated with the services may be collectively referred to herein in the present disclosure variously as system resources, computer system resources, services and resources.
In some embodiments, access to computer system services and/or resources may be based at least in part on where the services reside and/or where the resources are created. Services and/or resource may be created and may operate in a single region of a multi-region distributed computer system. A distributed computing system may, for example, comprise computing resources (e.g., various computers, network devices, and/or other computing devices) distributed among multiple data centers where the data centers are distributed geographically (e.g., among a set of legal jurisdictions, each corresponding to a different region). In some embodiments, it may be beneficial for a computing resources service provider to create services and/or resources one or more regions in order to facilitate system improvements such as lower latency communications, better resource balancing and/or other such system improvements. In some embodiments, services and/or resources created in one region may not be accessible or available to services and/or resources in a different region. In such embodiments, methods of providing access to resources across regions may be provided by routing and/or redirecting requests from one region to another. In some embodiments, a computing resource service may be configured to provide some of the capabilities for services and/or resources across regions.
A computing resource service is a service, such as a managed directory service, a web service and/or some other such computing resource service that may manage content, access, policies, users and/or other such computer system resources for a computer system resource such as a directory service, a web service and/or some other such computer system resource. The computer system resources that are managed by the computing resource service may be referred to herein as endpoints, system endpoints, computer system endpoints, resources, endpoint resources, computer system resources, system resources and/or other such terms. A computing resource service may provide computing resource operations for a computer system resource in a variety of ways. For example, a resource and/or service such as a directory as a service (DaaS), which may have operational capabilities to manage system users, resources, policies, network access and/or security on a computer system, may have access provided across regions by a computing resource service wherein the computing resource service may be configured to manage access to such capabilities across different regions in distributed and/or virtualized computer systems.
Other services may also be used to manage access to system services and/or resources across regions in distributed and/or virtualized computer systems. For example, a resource and/or service such as a DaaS may be created in, and may operate in, a certain region in a distributed and/or virtualized computer system. The DaaS may have a unique identifier that may be available to computer system entities in that region and may also have a unique locator such as a URI that may be used to locate the DaaS within the region using a service such as a computing resource service. A user, process, service, application or other such computer system entity may require access to the DaaS and may require such access from a different region, where the DaaS is not available or accessible. A computer system may provide such remote access by, in some embodiments, providing a different URI to the computer system user, process, service, application or other such computer system entity and then may redirect the second URI to the DaaS endpoint using computer system services, capabilities, operations and/or other such computer system resources.
A distributed and/or virtualized computer system may provide a URI which may be redirected to computer system entities and may, in some embodiments, provide a single URI to computer system entities regardless of which region such entities may be located. The URI may, in some embodiments, be a uniform resource identifier (URI), a uniform resource locator (URL) or some other such resource identifier and will simply be referred to in the present disclosure as “uniform resource identifier” or “URI.” In some embodiments, the provided URI may be based on the endpoint URI of the regional computer system resource. In some embodiments, the provided URI may have little relationship to the endpoint URI of the regional computer system resource and may instead be determined by customer need, system policies, administrator choice, system configuration values such as date, time, machine identifier, customer identifier or combinations of these and/or other such factors.
The provided URI may be transferred to a computer system routing service which may be configured to at least determine the location that the provided URI originates from and to determine what region the endpoint URI is in, and may then be able to route the request to an appropriate content provider service based at least in part on the originating region of the request and the destination endpoint of the computer system resource. In some embodiments, the computer system may implement one content provider service for each region in the distributed and/or virtualized computer system. For example, in a distributed and/or virtualized computer system with four regions, there may be four content provider service instances with each one configured to at least process content requests for a single region.
Each content provider instance may then redirect the provided URI to the appropriate content in the appropriate region based at least in part on the destination endpoint of the computer system resource and/or on the contents of the provided URI. For example, a provided URI may include commands, arguments and/or other such data that indicates that the requesting computer system entity wishes to access a system maintenance console for the computer system resource. The content provider may use the information in the provided URI to locate one or more folders in the regional content that correspond to the destination endpoint of the computer system resource and may use the commands, arguments and/or other such data to locate the one folder that contains instructions, executable code, scripts, applications, data and/or other such redirection information to provide the content for the login console to the requesting computer system entity.
In some embodiments, there may be several commands and/or operations that a computer system resource such as a DaaS may provide to a requesting computer system entity. For example, a computer system resource may expose commands to login, execute a console, reset and manage the computer system resource. Each command may have a single folder in the regional content container that contains the instructions, executable code, scripts, applications, data and/or other such redirection resources for that command, on that computer system resource. If the distributed and/or virtualized computer system has, for example, four regions, then each of the four regional content management system instances may have access to each of the four command folders, resulting in, in this instance, sixteen folders with four for each region.
In some embodiments, the folders may be statically configured at the time that the computer system resource is created. Such folders and the content container that holds them may be regional, so that there may be one content container for each region. In some embodiments, the content management system instances may also be statically configured at the time that the computer system resource and/or the content containers are created. Such content management instances may be non-regional and may be available to any computer system entity in the distributed and/or virtualized computer system. In some embodiments, the routing service may be dynamically configured and may exist prior to the creation of the other entities described herein. As new content management instances are created in response to the creation of content containers and computer system resources, entries in the routing service table may be added to provide access to the content management instances via the provided URI.
In some embodiments, the services described herein that are associated with providing the access to a computer system resource may be created at the time that the resource is created. In some embodiments, the services described herein may be created after the computer system resource is created, if it is determined later that the computer system resource needs to be made more available. For example, in an embodiment where the computer system resource is a DaaS, a user may create a directory service that the user intends to remain private and not be made available to other computer system entities in different regions of a distributed and/or virtualized computer system. At a later date, the user may decide that the computer system resource needs to be available to computer system entities in different regions and may, at that time, add content containers with access resources, content delivery instances and routing service table entries to make the computer service resource available to the different regions. The user may also, at this time, provide the access URI that computer system entities in other regions may use to access the resource using the redirection approach described herein.
In some embodiments one or more computer system content provider services may be running on a computing resource service provider that may provide access to computer services such as virtual machine (VM) instances, automatic scaling groups, file-based database storage systems, block storage services, redundant data storage services, data archive services, data warehousing services, user access management services, content management services and/or other such computer system services. The computing resource service provider may also provide access to computer system services and resources such as user resources, policy resources, network resources and/or storage resources associated with the computer system services. In some distributed and/or virtualized computer system environments, the resources associated with the computer services may be physical devices, virtual devices, combinations of physical and/or virtual devices or other such device embodiments.
In some embodiments, access to the computer system content provider service and/or other services running on the computer resource service provider may be provided by one or more connections between sets of one or more computer system entities such as connection 106. A computer system entity or resource such as computer system user, process or service may connect to another local and/or remote computer system entity or resource using one or more connection protocols such as network protocols or other such communication protocols over one or more connections such as the network connections described herein. A connection between a computer system entity and a computer system resource may, for example, be a one way connection, a two-way connection, a read-only connection, a read-write connection or a combination of these and/or other connection types. Access to the computer system content provider service and/or other services running on the computing resource service provider may be controlled, regulated and/or maintained by access credentials provided by the computing resource service provider and/or one or more other services running on the computing resource service provider. In some embodiments, connection credentials may include credentials such as user names, passwords, key phrases, biometric devices, hardware keys, virtual hardware keys and other such authentication and/or authorization credentials.
The computer system content 110 may include content 108 that may provide access to local and/or remote resources on the computer system. In some embodiments, the content 108 that may provide access to local and/or remote resources on the computer system may include links or locators such as a uniform resource identifier (URI), a uniform resource locator (URL) and/or some other such links or locators. In some embodiments, the URI may be provided by one or more systems and may be based on location of the requesting computer system entity, location of the requested resource, type of the requesting computer system entity, type of the requested resource, access permissions associated with the requesting computer system entity, access permissions associated with the requested resource or other such basis factors. In some embodiments, the content 108 may include instructions, executable code, scripts, applications, programs, processes and/or other such objects that may provide access to other local and/or remote resources on the computer system. In some embodiments, the content 108 may include combinations of links, executable objects or combinations of links, executable objects and/or other such objects that may provide access to other local and/or remote resources on the computer system. In some embodiments, the content 108 may include one or more folders containing links, executable objects or combinations of these and/or other such folders, instructions, executable instructions, or combinations of these and/or other such objects that may provide access to other local and/or remote resources on the computer system.
As mentioned herein, in some embodiments, the content 108 may include resource links such as a URI that may provide access 112 via a computing resource service 114 to an endpoint 118 containing the requested content or resource 116. A computing resource service as described below is a service which may, in some embodiments, be running on a computing resource service provider and which may be configured to at least provide access to computer system resources by one or more computer system services to one or more computer system resources. The endpoint 118 may be local, remote or a combination of local and/or remote and may be configured to provide content and/or other such types of data to computer system entities. In some embodiments, the endpoint may be a directory service, or a web service, or some such other service. In some embodiments, a computing resource service may be configured to, for example, manage directory services for an endpoint such as an enterprise directory. An enterprise directory is a directory which may contain a database of user access objects, policy objects, store objects, applications link objects, security objects and/or other such objects. An enterprise directory database may also include relationships between those database objects, so that the enterprise directory may be able to manage, for example, which users may have access to which stores. In some embodiments, an endpoint may include and/or provide one or more application programming interface (API) calls contained in one or more libraries that may be called by client applications, programs, services, processes and/or other such computer system entities to at least allow configuration, alteration, management and/or other such operations on the endpoint.
The one or more services 210 of the computing resource service provider 206 may, in some embodiments, require access to one or more system resources and/or endpoints 216 including, but not limited to, directory services, web services and/or other such services and may also require access to resources associated with such system resources such as user resources, policy resources, network resources and/or storage resources associated with the resources and/or services. In some embodiments, where the system resource or resources may be located within the computing resource service provider, the computer services resources provider may provide direct access to the one or more system resources. In some embodiments, where the system resource or resources may be located at least in part outside of the computing resource service provider such as, for example, at least in part on the customer premises, the computer services resources provider may request access to the one or more resources via one or more 214 links or locators such as, for example, by a URI or some other such link. The link may be managed by a service running on the computing resource service provider such as a computing resource service 212 which may be configured to at least provide access to computer system resources to one or more computer system services via one or more links or locators. The link may be provided by a process running within computing resource service provider, or by a process running within the customer premises, or by a process running on a computer system connected to the computing resource service provider, or by a process running on a computer system connected to the customer premises, or by the computing resource service or by a combination of these and/or other such computer system entities. In some embodiments, the process or processes that provide and/or manage the links and/or locators for the computing resource service as well as other processes associated with and/or under the control of the computing resource service may run on computer system entities and/or may use computer system resources within the computing resource service provider, or on the customer premises or on a combination of these and/or other such local and/or remote locations from the computing resource service provider.
The computer system client device 304 may be connected to the computer system using one or more networks 308 and/or entities associated therewith, such as other servers connected to the network, either directly or indirectly. The computer system client device may include any device that is capable of connecting with the computer system via a network, including at least servers, laptops, mobile devices such as smartphones or tablets, distributed computing systems and components thereof, abstracted components such as guest computer systems or virtual machines and/or other types of computing devices and/or components. The network may include, for example, a local network, an internal network, a public network such as the Internet, a wide-area network, a wireless network, a mobile network, a satellite network, a distributed computing system with a plurality of network nodes and/or the like.
In some embodiments, the computer system client device 304 may access one or more authentication processes 312 running on and/or under the control of a computing resource service 310 wherein the authentication processes may be configured to at least respond to requests from external processes and to authenticate the credentials of requesting computer system entities, users or processes. For example, the authentication processes may validate 314 whether a requesting computer system entity, user or process is allowed to access the computing resource service. The authentication process may validate access to the computing resource service by verifying a user name and password combination, or by verifying a cryptographic key stored on a hardware, software, firmware or other such device, or by verifying whether the computer system client device is authorized to request access, or by verifying whether the network is authorized to request access or by a combination of these and/or other such verification methods. The authentication process may perform other such authentication tasks and may, in some embodiments, perform authentication tasks in combination with other processes running on and/or with data stored on the computer system and/or on other computer systems.
In some embodiments, a computer system entity, user or process 302 as described herein may connect to a computer system through a computer system client device 304 as described herein, using one or more networks 308 and/or entities associated therewith as described herein, and may 316 request authorization to perform one or more operations and/or processes on one or more computer system resources 332 which may be located, for example, at least in part in a datacenter such as the datacenter described herein at least in connection with
Examples of operations and/or processes that may be authorized include, but are not limited to, 320 creating and/or destroying resource objects, 322 reading and/or writing resource objects and/or other such system resource operations. Authorization may vary by entity, user or process, by time of the day, by class of entity, by class of user, by class of process, by one or more system policies, by the nature of the request or by a combination of these and/or other such considerations. For example, a computer system entity may be authorized to create files and/or directories but may not be authorized to delete them, or a process may be authorized only to delete files and/or directories that were created by that process and no others, or an entity may be authorized to read certain files in certain directories, but not others. As may be contemplated, these are illustrative examples. Other types of operations may be authorized by the computing resource service authorization system and such other types of operations are also considered as being within the scope of the present disclosure.
In some embodiments, a computer system entity, user or process 302 as described herein may connect to a computer system through a computer system client device 304 as described herein, using one or more networks 308 and/or entities associated therewith as described herein, and may 324 create and/or instantiate one or more remote services 328 that may request access to one or more file systems 332. In some embodiments, the computer service, process or entity 328 may access one or more computing resource service operations processes 326 running on and/or under the control of a computing resource service 310 wherein the computing resource service operations processes may be configured to at least respond to requests from external processes and to provide access to one or more file systems. Access to one or more file systems may include access to operations such as operations to read, write, execute, delete, create, instantiate and/or other such operations, on files and/or other file system objects such as directories, applications, data, databases, links to other file systems, system drivers, computer operating systems, virtual machines and/or other such file system objects. In some embodiments, access to operations may be facilitated by communication 330 with one or more authorization processes 318 as described herein, providing authorization according to resource authorization policies contained therein.
The content 418 may be provided by a computing resource service as described herein at least in connection with
A managed directory service may provide varying levels of access to different users associated with an account of a computing resource service provider that provides the managed directory service. For example, some users may be able to create and delete directories while other users may lack authorization to delete directories.
A computing resource service may receive a request 602 to allow the requester to access the computing resource service and one or more of the commands, resources and/or services provided by the computing resource service. In some embodiments, the requester may be a computer system entity, user or process such as the computer system entity, user or process described herein at least in connection with
The computing resource service may first 604 authenticate the user using processes such as the processes described herein at least in connection with
Once the computing resource service 610 begins receiving commands from the requester, the computing resource service may 614 determine whether the requester is authorized to perform each command. The computing resource service may authorize the requester to perform each command using authorization processes such as the authorization processes described herein at least in connection with
If the requester is 614 not authorized to perform the received command, the computing resource service may 616 reject the particular command and may then determine whether it should 612 continue processing commands from the requester. In some embodiments, some rejected commands may result in not performing the command, some rejected commands may result in alerting the requester and/or other computer system entities that the command has been rejected, some rejected commands may result in terminating the connection to the requester and some rejected commands may result in a combination of these and/or other such actions. If the computing resource service does elect to 612 continue receiving commands from the requester, the computing resource service may 610 wait for the next command. If the computing resource service does not elect to 612 continue, the computing resource service may 622 disconnect the requester. In some embodiments, 622 disconnecting the requester may include disconnecting the requester, notifying the requester of the disconnection, notifying one or more other computer system entities of the disconnection or a combination of these and/or other such disconnection actions.
If the requester is 614 authorized to perform the received command, the computing resource service may 618 allow the command to be fulfilled, which may include performing the command, alerting the requester that the command is allowed, alerting one or more other system entities that the command is allowed, requesting one or more other system entities to perform the command or a combination of these and/or other such responses. The received command and/or a response to the 618 allow command may include at least in part a 620 request to disconnect which may cause the computing resource service to 622 disconnect the requester. If the computing resource service does not receive a 620 disconnect command, the computing resource service may 610 wait for the next command.
A user 702 may, for example, desire to login to a resource such as a computer system endpoint resource 740 using a provided alias 704 for the URI. The alias may first be examined by a computer system routing instance 706 which, based at least in part on the region of the user and on the contents of the URI alias, determine the proper routing for the login request. For example, the computer system routing instance may determine that the URI alias comes from a region referred to herein as region 2 and may 708 route the login URI request to a global computer service content provider instance 714 that may be dedicated to providing services for requests that originate in region 2. The computer system routing may also determine that the URI alias comes from a region referred to herein as region 3 and may 710 route the login URI request to a global computer service content provider instance 718 that may be dedicated to providing services for requests that originate in region 3. The computer system routing may also determine that the URI alias comes from a region referred to herein as region 4 and may 712 route the login URI request to a global computer service content provider instance 728 that may be dedicated to providing services for requests that originate in region 4. As may be contemplated, these regions and the routing of these aliases are merely illustrative examples and other methods of routing requests to the appropriate regions may be considered as within the scope of the present disclosure.
Once the correct global computer service content provider instance is determined and the login URI request is routed there, the global computer system content provider instance may further determine the proper routing for the URI alias based on the contents and/or nature of the request. For example, a login request from region 2 may use 716 commands, executable code, scripts, redirection and/or other such methods to 734 route the login request to 740 the region 1 endpoint resource as described herein at least in connection with
The login request 704 that originates from region 3 may be routed to the global computer service content provider instance 718 that may be dedicated to providing services for requests that originate in region 3 as described herein and in accordance with at least one embodiment. A login request from region 3 may use 720 commands, executable code, scripts, redirection and/or other such methods to 736 route the login request to 740 the region I endpoint resource. Other commands may use different sets of commands such as, for example, for 722 reset, 724 change or 726 console, but may still, in some embodiments, route the commands to 740 the region 1 endpoint resource via the computing resource service.
A user, process, application, service and/or other such entity may 802 request access to a computer system resource such as an endpoint as described herein at least in connection with
If the routing service is 808 able to determine the proper address to route the request to, the routing service may 810 route the request to the proper address which may, in some embodiments, be received by a content delivery service instance for further processing. In some embodiments, each region may have one or more content delivery services that may provide one or more content delivery service instances to receive the routed request from the routing service. In some embodiments, the content delivery service may be statically configured to receive the requests for at least one region and to deliver the content for that region. In some embodiments, the content delivery service and/or the content delivery regions may be globally accessible to the routing service.
The content delivery service instance may then 812 parse the received request to determine what command may be requested by the user. In some embodiments, a static set of commands that correspond to permitted operations on the endpoint may be provided to the user. For example, a user may be able to request commands including, but not limited to, logging in, resetting, accessing a console and/or other such commands. The content delivery service instance may then 814 attempt to locate the operation folder based on the requested command. In some embodiments, the operation folder may be located in a content location that is local to the endpoint resource. In such embodiments, the content delivery service instance may access the operation folder using one or more computer service capabilities such as networking capabilities as described herein. If the content delivery service instance is 816 not able to locate the operation folder, the content delivery service instance may 822 return an error to the user. In some embodiments, the content delivery service instance may return the error directly to the user. In some embodiments, the content delivery service instance may return the error to the user via the content delivery service, or via the routing service or via a combination of these and/or other such computer system services.
If the content delivery service instance is 816 able to locate the operation folder, the content delivery service instance may then 818 locate one or more sections of executable code, scripts, commands, processes and/or other such informational resources and execute and/or process those informational resources to access the endpoint. In some embodiments, each command, for each endpoint may correspond to a single operational folder. In such embodiments, the contents of the operational folders may be statically configured such that each endpoint may have one static folder for each command in each region. If the content delivery service is able to 820 access the endpoint via the informational resources, the operation requested by the user and/or any endpoint capabilities requested by the operation may be 824 provided to the user via a combination of the content delivery service instance and a computing resource service as described herein at least in connection with
A 902 computer system user, process, application, service and/or other such entity may 904 request the creation of a computer system resource such as a computer system endpoint. In some embodiments, the request to create the computer system resource may be sent to a computing resource service provider 906. The computing resource service provider may create the 908 computer system resource. In some embodiments, as part of creating the resource, the computing resource service provider may create an identifier for the resource and may also create and 910 publish a URI for the resource. The resource identifier and the resource URI may be used by the computer system and by computer services provided by the computing resource service provider to access the resource. In some embodiments, the resource identifier and/or the resource URI may be published to a 912 routing service such as the routing service described herein at least in connection with
A 914 computer system user, process, application, service and/or other such entity may also 916 request the creation of an alias URI for 910 the published computer system resource URI. In some embodiments, the request to create the alias may be sent to the computing resource service provider 906. The alias URI may be 918 published to a 912 routing service such as the routing service described herein at least in connection with
A request to create an endpoint resource such as a directory service, a web service and/or other such services (referred to herein as a “service”) may be generated 1002 by a computer system entity. In some embodiments, the service may include one or more storage locations, one or more access permissions, one or more policies and/or one or more other such service capabilities. In some embodiments, the request to create the service may originate from a user, or a process, or an application, or a service or from some other such computer system entity. If 1004 the service is not successfully created because, for example, the computer system does not have the resources to create the service, then 1016 an error message may be generated and transferred back to the requesting entity using one or more computer system capabilities.
If 1004 the service is successfully created, the system may, in some embodiments, 1006 create a unique identifier for the service. In some embodiments, the identifier may be generated from the date of creation, the time of creation, the region of the creation, the entity that requested creation, one or more globally unique identifiers or a combination of these and/or other factors and/or identifiers. In some embodiments the system may also 1008 create a URI based on the service identifier so that the service may be accessible using a computing resource service as described herein at least in connection with
Once the service identifier and/or the service URI are created, the computer system may then 1010 publish the service identifier and/or the service URI to a routing table such as the routing table described herein at least in connection with
A service may be created according to the process illustrated in
As noted above, a computing resource service provider 1206 may provide various computing resource services to its customers. For instance, in this particular illustrative example, the computing resource service provider 1206 provides a number of services. The services provided by the computing resource service provider, in this example, include a computing resource service 1208, an identity management service 1210, an object-based data storage service 1212, a block-level data storage service 1214, a database service 1216, a virtual computer system service 1218, a domain name system service 1220 and one or more other services 1222. In some embodiments, one or more of the illustrated services may be provided by the computing resource service provider in addition to, or as an alternative to, the services explicitly described herein. In some embodiments, additional services may also be provided by the computing resource service provider in addition to, or as an alternative to, the services explicitly described herein.
The computing resource service 1208 may provide a variety of services to enable computer systems and/or computer system client devices to access system resources including, but not limited to, authentication, authorization and other management service operations as described herein at least in connection with
The computing resource service 1208 may also provide authorization services which may authorize a user, computer system, process, automated process or other such entity to at least determine which actions of one or more possible actions that entity may perform. Examples of actions that an entity may or may not be authorized to perform include, but are not limited to, creating resources, destroying resources, attaching to resources, detaching from resources, providing access links to resources, reclaiming access links to resources, allowing reads from resources, allowing writes to resources and/or other such actions.
The computing resource service 1208 may also provide resource management services which may provide an authenticated entity access to the system resources according to the authorization credentials and/or policies. For example, in an embodiment where a computer system entity may be authorized to read and write a certain data store on a certain directory, the ability to do so may be provided by the resource management services. The resource management services may provide access to customer directories by providing links to the customer directory locations such as by a URI object or some other such linkage. The URI may be provided by the computer system client device, or by a process running at the data center, or by a process running on a computer system connected to the datacenter, or by the computing resource service or by a combination of these and/or other such computer system entities.
The identity management service 1210 may provide a variety of services to enable customers to define a level of access to other services, such as those illustrated in
As noted above, a customer 1202 may utilize a set of credentials to access the computing resource service provider 1206. The identity management service 1210 may be configured to verify the identity of the customer 1202 within the identity management service 1210. Accordingly, the customer 1202 may be able to access the computing resource service 1208 and request one or more identity management services. In some embodiments, the customer 1202 may utilize the identity management service 1210 to identify one or more users of the computing resource service provider 1206 that may be permitted to utilize a new appropriately configured API call provided by the computing resource service 1208 to access computing system resources.
The object-based data storage service 1212 may comprise a collection of computing resources that collectively operate to store data for a customer 1202. The data stored in the object-based data storage service 1212 may be organized into data objects. The data objects may have arbitrary sizes except, perhaps, for certain constraints on size. Thus, the object-based data storage service 1212 may store numerous data objects of varying sizes. The object-based data storage service 1212 may operate as a key value store that associates data objects with identifiers of the data objects which may be used by the customer to retrieve or perform other operations in connection with the data objects stored by the data storage service 1212. Access to the data storage service may be through appropriately configured API calls.
The block-level data storage service 1214 may comprise a collection of computing resources that collectively operate to store data for a customer. For instance, the block-level data storage system may be configured to provide block-level data storage volumes for use with a virtual machine instance. A customer 1202 may interact with the block-level data storage service 1214 to provision a block-level data storage volume that, in turn, may be mounted as a storage device (e.g., hard drive) onto a virtual machine instance. The storage volume may be configured to behave like a raw, unformatted block storage device with a block level customer interface. Accordingly, a customer, through properly configured API calls to the service, may create a file system on top of the block-level data storage volumes or utilize the volume as a block-level storage device (e.g., a hard drive).
The database service 1216 may be a collection of computing resources that collectively operate to run one or more databases for one or more customers. Customers 1202 of the computing resource service provider 1206 may operate and manage a database from the database service 1216 by utilizing appropriately configured API calls. This, in turn, may allow a customer 1202 to maintain and potentially scale the operations in the database.
The virtual computer system service 1218 may be a collection of computing resources configured to instantiate virtual machine instances onto virtual computing systems on behalf of the customers 1202 of the computing resource service provider 1206. Customers 1202 of the computing resource service provider 1206 may interact with the virtual computer systems service 1218 to provision and operate virtual computer systems that are instantiated on physical computing devices hosted and operated by the computing resource service provider. The virtual computer systems may be used for various purposes, such as to operate as servers supporting a website. Other applications for the virtual computer systems may be to support database applications, electronic commerce applications, business applications and/or other applications.
The Domain Name System (DNS) service 1220 may be designed to give customers 1202 a method to route end users to one or more communications network applications. For instance, the DNS service 1220 may be configured to translate human-readable names, such as a URL or a URI, into numeric Internet Protocol (IP) addresses that computer systems may use to connect to each other over the Internet. Thus, the DNS service 1220 may be configured to connect requests to access one or more services provided by the computing resource service provider 1206 to the infrastructure that is operating within a data zone. The DNS service 1220 may additionally be configured to route customers 1202 of the computing resource service provider 1206 to infrastructure outside of the data zone, such as another computing system operated by a separate provider.
The computing resource service provider 1206 may additionally maintain one or more other services 1222 based on the needs of its customers 1202. For instance, the computing resource service provider 1206 may maintain an account service which may comprise a collection of computing resources that collectively operate to maintain customer account information for each customer 1202 of the computing resource service provider 1206. The account service may include, for example, the customer name, address, phone numbers, billing details and other personal identification information for each customer of the computing resource service provider. Other services include, but are not limited to, load balancing services and services that manage other services and/or other services.
The illustrative environment includes at least one application server 1308 and a data store 1310. It should be understood that there can be several application servers, layers or other elements, processes or components, which may be chained or otherwise configured, which can interact to perform tasks such as obtaining data from an appropriate data store. Servers, as used herein, may be implemented in various ways, such as hardware devices or virtual computer systems. In some contexts, servers may refer to a programming module being executed on a computer system. As used herein, unless otherwise stated or clear from context, the term “data store” refers to any device or combination of devices capable of storing, accessing and retrieving data, which may include any combination and number of data servers, databases, data storage devices and data storage media, in any standard, distributed, virtual or clustered environment. The application server can include any appropriate hardware, software and firmware for integrating with the data store as needed to execute aspects of one or more applications for the client device, handling some or all of the data access and business logic for an application. The application server may provide access control services in cooperation with the data store and is able to generate content including, but not limited to, text, graphics, audio, video and/or other content usable to be provided to the user, which may be served to the user by the web server in the form of HyperText Markup Language (“HTML”), Extensible Markup Language (“XML”), JavaScript, Cascading Style Sheets (“CSS”) or another appropriate client-side structured language. Content transferred to a client device may be processed by the client device to provide the content in one or more forms including, but not limited to, forms that are perceptible to the user audibly, visually and/or through other senses including touch, taste, and/or smell. The handling of all requests and responses, as well as the delivery of content between the client device 1302 and the application server 1308, can be handled by the web server using PHP: Hypertext Preprocessor (“PHP”), Python, Ruby, Perl, Java, HTML, XML or another appropriate server-side structured language in this example. It should be understood that the web and application servers are not required and are merely example components, as structured code discussed herein can be executed on any appropriate device or host machine as discussed elsewhere herein. Further, operations described herein as being performed by a single device may, unless otherwise clear from context, be performed collectively by multiple devices, which may form a distributed and/or virtual system.
The data store 1310 can include several separate data tables, databases, data documents, dynamic data storage schemes and/or other data storage mechanisms and media for storing data relating to a particular aspect of the present disclosure. For example, the data store illustrated may include mechanisms for storing production data 1312 and user information 1316, which can be used to serve content for the production side. The data store also is shown to include a mechanism for storing log data 1314, which can be used for reporting, analysis or other such purposes. It should be understood that there can be many other aspects that may need to be stored in the data store, such as page image information and access rights information, which can be stored in any of the above listed mechanisms as appropriate or in additional mechanisms in the data store 1310. The data store 1310 is operable, through logic associated therewith, to receive instructions from the application server 1308 and obtain, update or otherwise process data in response thereto. The application server 1308 may provide static, dynamic or a combination of static and dynamic data in response to the received instructions. Dynamic data, such as data used in web logs (blogs), shopping applications, news services and other such applications may be generated by server-side structured languages as described herein or may be provided by a content management system (“CMS”) operating on, or under the control of, the application server. In one example, a user, through a device operated by the user, might submit a search request for a certain type of item. In this case, the data store might access the user information to verify the identity of the user and can access the catalog detail information to obtain information about items of that type. The information then can be returned to the user, such as in a results listing on a web page that the user is able to view via a browser on the user device 1302. Information for a particular item of interest can be viewed in a dedicated page or window of the browser. It should be noted, however, that embodiments of the present disclosure are not necessarily limited to the context of web pages, but may be more generally applicable to processing requests in general, where the requests are not necessarily requests for content.
Each server typically will include an operating system that provides executable program instructions for the general administration and operation of that server and typically will include a computer-readable storage medium (e.g., a hard disk, random access memory, read only memory, etc.) storing instructions that, when executed by a processor of the server, allow the server to perform its intended functions. Suitable implementations for the operating system and general functionality of the servers are known or commercially available and are readily implemented by persons having ordinary skill in the art, particularly in light of the disclosure herein.
The environment, in one embodiment, is a distributed and/or virtual computing environment utilizing several computer systems and components that are interconnected via communication links, using one or more computer networks or direct connections. However, it will be appreciated by those of ordinary skill in the art that such a system could operate equally well in a system having fewer or a greater number of components than are illustrated in
The various embodiments further can be implemented in a wide variety of operating environments, which in some cases can include one or more user computers, computing devices or processing devices which can be used to operate any of a number of applications. User or client devices can include any of a number of general purpose personal computers, such as desktop, laptop or tablet computers running a standard operating system, as well as cellular, wireless and handheld devices running mobile software and capable of supporting a number of networking and messaging protocols. Such a system also can include a number of workstations running any of a variety of commercially-available operating systems and other known applications for purposes such as development and database management. These devices also can include other electronic devices, such as dummy terminals, thin-clients, gaming systems and other devices capable of communicating via a network. These devices also can include virtual devices such as virtual machines, hypervisors and other virtual devices capable of communicating via a network.
Various embodiments of the present disclosure utilize at least one network that would be familiar to those skilled in the art for supporting communications using any of a variety of commercially-available protocols, such as Transmission Control Protocol/Internet Protocol (“TCP/IP”), User Datagram Protocol (“UDP”), protocols operating in various layers of the Open System Interconnection (“OSI”) model, File Transfer Protocol (“FTP”), Universal Plug and Play (“UpnP”), Network File System (“NFS”), Common Internet File System (“CIFS”) and AppleTalk. The network can be, for example, a local area network, a wide-area network, a virtual private network, the Internet, an intranet, an extranet, a public switched telephone network, an infrared network, a wireless network, a satellite network and any combination thereof.
In embodiments utilizing a web server, the web server can run any of a variety of server or mid-tier applications, including Hypertext Transfer Protocol (“HTTP”) servers, FTP servers, Common Gateway Interface (“CGI”) servers, data servers, Java servers, Apache servers and business application servers. The server(s) also may be capable of executing programs or scripts in response to requests from user devices, such as by executing one or more web applications that may be implemented as one or more scripts or programs written in any programming language, such as Java®, C, C# or C++, or any scripting language, such as Ruby, PHP, Perl, Python or TCL, as well as combinations thereof. The server(s) may also include database servers, including without limitation those commercially available from Oracle®, Microsoft®, Sybase® and IBM® as well as open-source servers such as MySQL, Postgres, SQLite, MongoDB, and any other server capable of storing, retrieving and accessing structured or unstructured data. Database servers may include table-based servers, document-based servers, unstructured servers, relational servers, non-relational servers or combinations of these and/or other database servers.
The environment can include a variety of data stores and other memory and storage media as discussed above. These can reside in a variety of locations, such as on a storage medium local to (and/or resident in) one or more of the computers or remote from any or all of the computers across the network. In a particular set of embodiments, the information may reside in a storage-area network (“SAN”) familiar to those skilled in the art. Similarly, any necessary files for performing the functions attributed to the computers, servers or other network devices may be stored locally and/or remotely, as appropriate. Where a system includes computerized devices, each such device can include hardware elements that may be electrically coupled via a bus, the elements including, for example, at least one central processing unit (“CPU” or “processor”), at least one input device (e.g., a mouse, keyboard, controller, touch screen or keypad) and at least one output device (e.g., a display device, printer or speaker). Such a system may also include one or more storage devices, such as disk drives, optical storage devices and solid-state storage devices such as random access memory (“RAM”) or read-only memory (“ROM”), as well as removable media devices, memory cards, flash cards, etc.
Such devices also can include a computer-readable storage media reader, a communications device (e.g., a modem, a network card (wireless or wired), an infrared communication device, etc.) and working memory as described above. The computer-readable storage media reader can be connected with, or configured to receive, a computer-readable storage medium, representing remote, local, fixed and/or removable storage devices as well as storage media for temporarily and/or more permanently containing, storing, transmitting and retrieving computer-readable information. The system and various devices also typically will include a number of software applications, modules, services or other elements located within at least one working memory device, including an operating system and application programs, such as a client application or web browser. It should be appreciated that alternate embodiments may have numerous variations from that described above. For example, customized hardware might also be used and/or particular elements might be implemented in hardware, software (including portable software, such as applets) or both. Further, connection to other computing devices such as network input/output devices may be employed.
Storage media and computer readable media for containing code, or portions of code, can include any appropriate media known or used in the art, including storage media and communication media, such as, but not limited to, volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage and/or transmission of information such as computer readable instructions, data structures, program modules or other data, including RAM, ROM, Electrically Erasable Programmable Read-Only Memory (“EEPROM”), flash memory or other memory technology. Compact Disc Read-Only Memory (“CD-ROM”), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other medium which can be used to store the desired information and which can be accessed by the system device. Based on the disclosure and teachings provided herein, a person of ordinary skill in the art will appreciate other ways and/or methods to implement the various embodiments.
The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense. It will, however, be evident that various modifications and changes may be made thereunto without departing from the broader spirit and scope of the invention as set forth in the claims.
Other variations are within the spirit of the present disclosure. Thus, while the disclosed techniques are susceptible to various modifications and alternative constructions, certain illustrated embodiments thereof are shown in the drawings and have been described above in detail. It should be understood, however, that there is no intention to limit the invention to the specific form or forms disclosed, but on the contrary, the intention is to cover all modifications, alternative constructions and equivalents falling within the spirit and scope of the invention, as defined in the appended claims.
The use of the terms “a” and “an” and “the” and similar referents in the context of describing the disclosed embodiments (especially in the context of the following claims) are to be construed to cover both the singular and the plural, unless otherwise indicated herein or clearly contradicted by context. The terms “comprising,” “having,” “including” and “containing” are to be construed as open-ended terms (i.e., meaning “including, but not limited to,”) unless otherwise noted. The term “connected,” when unmodified and referring to physical connections, is to be construed as partly or wholly contained within, attached to or joined together, even if there is something intervening. Recitation of ranges of values herein are merely intended to serve as a shorthand method of referring individually to each separate value falling within the range, unless otherwise indicated herein and each separate value is incorporated into the specification as if it were individually recited herein. The use of the term “set” (e.g., “a set of items”) or “subset” unless otherwise noted or contradicted by context, is to be construed as a nonempty collection comprising one or more members. Further, unless otherwise noted or contradicted by context, the term “subset” of a corresponding set does not necessarily denote a proper subset of the corresponding set, but the subset and the corresponding set may be equal.
Conjunctive language, such as phrases of the form “at least one of A, B, and C,” or “at least one of A, B and C,” unless specifically stated otherwise or otherwise clearly contradicted by context, is otherwise understood with the context as used in general to present that an item, term, etc., may be either A or B or C. or any nonempty subset of the set of A and B and C. For instance, in the illustrative example of a set having three members, the conjunctive phrases “at least one of A, B, and C” and “at least one of A, B and C” refer to any of the following sets: {A}, {B}, {C}, {A, B}, {A, C}, {B, C}, {A, B, C}. Thus, such conjunctive language is not generally intended to imply that certain embodiments require at least one of A, at least one of B and at least one of C each to be present.
Operations of processes described herein can be performed in any suitable order unless otherwise indicated herein or otherwise clearly contradicted by context. Processes described herein (or variations and/or combinations thereof) may be performed under the control of one or more computer systems configured with executable instructions and may be implemented as code (e.g., executable instructions, one or more computer programs or one or more applications) executing collectively on one or more processors, by hardware or combinations thereof. The code may be stored on a computer-readable storage medium, for example, in the form of a computer program comprising a plurality of instructions executable by one or more processors. The computer-readable storage medium may be non-transitory.
The use of any and all examples, or exemplary language (e.g., “such as”) provided herein, is intended merely to better illuminate embodiments of the invention and does not pose a limitation on the scope of the invention unless otherwise claimed. No language in the specification should be construed as indicating any non-claimed element as essential to the practice of the invention.
Preferred embodiments of this disclosure are described herein, including the best mode known to the inventors for carrying out the invention. Variations of those preferred embodiments may become apparent to those of ordinary skill in the art upon reading the foregoing description. The inventors expect skilled artisans to employ such variations as appropriate and the inventors intend for embodiments of the present disclosure to be practiced otherwise than as specifically described herein. Accordingly, the scope of the present disclosure includes all modifications and equivalents of the subject matter recited in the claims appended hereto as permitted by applicable law. Moreover, any combination of the above-described elements in all possible variations thereof is encompassed by the scope of the present disclosure unless otherwise indicated herein or otherwise clearly contradicted by context.
All references, including publications, patent applications and patents, cited herein are hereby incorporated by reference to the same extent as if each reference were individually and specifically indicated to be incorporated by reference and were set forth in its entirety herein.
This application claims the benefit of U.S. Provisional Application No. 61/902,790. filed on Nov. 11, 2013, entitled “MANAGED DIRECTORY SERVICE,” the content of which is incorporated by reference herein in its entirety.
| Number | Name | Date | Kind |
|---|---|---|---|
| 6055637 | Hudson et al. | Apr 2000 | A |
| 6209036 | Aldred et al. | Mar 2001 | B1 |
| 6609128 | Underwood | Aug 2003 | B1 |
| 7574202 | Tsao et al. | Aug 2009 | B1 |
| 8045486 | Swan | Oct 2011 | B2 |
| 8145798 | Buck et al. | Mar 2012 | B1 |
| 8224994 | Schneider | Jul 2012 | B1 |
| 8255984 | Ghostine et al. | Aug 2012 | B1 |
| 8307003 | Sheth et al. | Nov 2012 | B1 |
| 8346824 | Lyle et al. | Jan 2013 | B1 |
| 8533796 | Shenoy et al. | Sep 2013 | B1 |
| 8656471 | Allen et al. | Feb 2014 | B1 |
| 8856506 | Weber et al. | Oct 2014 | B2 |
| 9213513 | Hartz et al. | Dec 2015 | B2 |
| 9639384 | Govindnkutty et al. | May 2017 | B2 |
| 20020143943 | Lee et al. | Oct 2002 | A1 |
| 20030074448 | Kinebuchi | Apr 2003 | A1 |
| 20030229645 | Mogi et al. | Dec 2003 | A1 |
| 20040205152 | Yasuda et al. | Oct 2004 | A1 |
| 20050102513 | Alve | May 2005 | A1 |
| 20050203993 | Grobman et al. | Sep 2005 | A1 |
| 20060059252 | Tatsubori | Mar 2006 | A1 |
| 20070112877 | Harvey et al. | May 2007 | A1 |
| 20070143829 | Hinton et al. | Jun 2007 | A1 |
| 20070300220 | Seliger et al. | Dec 2007 | A1 |
| 20070300221 | Hartz et al. | Dec 2007 | A1 |
| 20080016143 | Bumpus | Jan 2008 | A1 |
| 20080046593 | Ando | Feb 2008 | A1 |
| 20080140618 | Kumar | Jun 2008 | A1 |
| 20080208853 | Vismans | Aug 2008 | A1 |
| 20080320566 | Herzog et al. | Dec 2008 | A1 |
| 20090089625 | Kannappan et al. | Apr 2009 | A1 |
| 20090112875 | Maes | Apr 2009 | A1 |
| 20090157850 | Gagliardi | Jun 2009 | A1 |
| 20090178132 | Hudis et al. | Jul 2009 | A1 |
| 20090198835 | Madhusudanan et al. | Aug 2009 | A1 |
| 20090249439 | Olden et al. | Oct 2009 | A1 |
| 20090288084 | Astete et al. | Nov 2009 | A1 |
| 20090328178 | McDaniel et al. | Dec 2009 | A1 |
| 20100017889 | Newstadt et al. | Jan 2010 | A1 |
| 20100122248 | Robinson et al. | May 2010 | A1 |
| 20100142401 | Morris | Jun 2010 | A1 |
| 20100254375 | Feuerhahn et al. | Oct 2010 | A1 |
| 20110066668 | Guarraci | Mar 2011 | A1 |
| 20110099147 | McAlister et al. | Apr 2011 | A1 |
| 20110185355 | Chawla et al. | Jul 2011 | A1 |
| 20110191834 | Singh et al. | Aug 2011 | A1 |
| 20110251992 | Bethlehem et al. | Oct 2011 | A1 |
| 20110314520 | Olszewski et al. | Dec 2011 | A1 |
| 20120011578 | Hinton et al. | Jan 2012 | A1 |
| 20120017271 | Smith et al. | Jan 2012 | A1 |
| 20120030673 | Sakamoto | Feb 2012 | A1 |
| 20120066348 | Alnas | Mar 2012 | A1 |
| 20120110055 | Van Biljon et al. | May 2012 | A1 |
| 20120110574 | Kumar | May 2012 | A1 |
| 20120179802 | Narasimhan et al. | Jul 2012 | A1 |
| 20120179820 | Ringdahl et al. | Jul 2012 | A1 |
| 20120198022 | Black | Aug 2012 | A1 |
| 20120233314 | Jakobsson | Sep 2012 | A1 |
| 20120246738 | Shah et al. | Sep 2012 | A1 |
| 20120266168 | Spivak et al. | Oct 2012 | A1 |
| 20120281708 | Chauhan et al. | Nov 2012 | A1 |
| 20120290630 | Aizman et al. | Nov 2012 | A1 |
| 20130007845 | Chang et al. | Jan 2013 | A1 |
| 20130034021 | Jaiswal et al. | Feb 2013 | A1 |
| 20130042115 | Sweet et al. | Feb 2013 | A1 |
| 20130054639 | Sharma et al. | Feb 2013 | A1 |
| 20130066834 | McAlister et al. | Mar 2013 | A1 |
| 20130167145 | Krishnamurthy et al. | Jun 2013 | A1 |
| 20130174216 | Simske et al. | Jul 2013 | A1 |
| 20130191828 | Wells et al. | Jul 2013 | A1 |
| 20130198340 | Ukkola | Aug 2013 | A1 |
| 20130227140 | Hinton et al. | Aug 2013 | A1 |
| 20130230042 | Shatsky et al. | Sep 2013 | A1 |
| 20130238808 | Hallem et al. | Sep 2013 | A1 |
| 20130247036 | Fujiwara | Sep 2013 | A1 |
| 20130254847 | Adams et al. | Sep 2013 | A1 |
| 20130283270 | Holland et al. | Oct 2013 | A1 |
| 20130283298 | Ali et al. | Oct 2013 | A1 |
| 20140040993 | Lorenzo et al. | Feb 2014 | A1 |
| 20140075501 | Srinivasan et al. | Mar 2014 | A1 |
| 20140250075 | Broido et al. | Sep 2014 | A1 |
| 20140282510 | Anderson et al. | Sep 2014 | A1 |
| 20140298398 | Neely | Oct 2014 | A1 |
| 20140325622 | Luk et al. | Oct 2014 | A1 |
| 20140365549 | Jenkins | Dec 2014 | A1 |
| 20150058837 | Govindankutty et al. | Feb 2015 | A1 |
| 20150089061 | Li et al. | Mar 2015 | A1 |
| 20150237149 | MacInnis | Aug 2015 | A1 |
| 20170337071 | Scott et al. | Nov 2017 | A1 |
| Number | Date | Country |
|---|---|---|
| 2964813 | Mar 2012 | FR |
| 2004355439 | Dec 2004 | JP |
| 2005004648 | Jan 2005 | JP |
| 2005258672 | Sep 2005 | JP |
| 2009519530 | May 2009 | JP |
| 2009176097 | Aug 2009 | JP |
| 2010027028 | Feb 2010 | JP |
| 2010092475 | Apr 2010 | JP |
| 2011186637 | Sep 2011 | JP |
| 2012032956 | Feb 2012 | JP |
| 2012123459 | Jun 2012 | JP |
| 2013084235 | May 2013 | JP |
| 2013527532 | Jun 2013 | JP |
| 2013532854 | Aug 2013 | JP |
| 2013540314 | Oct 2013 | JP |
| 2015503782 | Feb 2015 | JP |
| 2016540295 | Dec 2016 | JP |
| WO2011106716 | Sep 2011 | WO |
| WO2013146537 | Oct 2013 | WO |
| Entry |
|---|
| International Search Report and Written Opinion dated Feb. 4, 2015, International Patent Application No. PCT/US2014/064894, filed Nov. 10, 2014, 14 pages. |
| International Search Report and Written Opinion dated Feb. 19, 2015, International Patent Application No. PCT/US2014/065084, filed Nov. 11, 2014, 15 pages. |
| International Search Report and Written Opinion dated Feb. 11, 2015, International Patent Application No. PCT/US2014/065081, filed Nov. 11, 2014, 11 pages. |
| International Search Report and Written Opinion dated Feb. 23, 2015, International Patent Application No. PCT/US2014/065088, filed Nov. 11, 2014, 13 pages. |
| Bucicoiu et al., “Secure Cloud Video Streaming Using Tokens,” RoEduNet Conference 13th Edition: Networking in Education and Research Joint Event Renam 8th Conference, Jan. 2014, 6 pages. |
| Carrion et al., “A Generic Catalog and Repository Service for Virtual Machine Images,” 2010, University of Valencia, retrieved from internet https://www.researchgate.net/profile/German_Molto/publication/233906883_A_Generic_Catalog_and_Repository_Service_for_Virtual_Machine_Images/links/Ofcfd50cbb119a1184000000.pdf, 15 pages. |
| Lopez et al., “Providing secure mobile access to information servers with temporary certificates,” 1999, retrieved from http://ac.els-cdn.com/S138912869900105X/1-s2.0-S138912869900105X-main.pdf?_tid=8d31c448-e679-11e6-b14f-00000aacb35f&acdnat=1485732221_f0f3684af0254bee6476a83214f9cf32, 5 pages. |
| Anonymous, “vCloud Automation Center Operating Guide for vCloud Automation Center 5.2,” VMware, Jul. 17, 2013, retrieved on May 8, 2017, from https://web-beta.archive.org/web/20130717235803/http://www.vmware.com/pdf/vcac-52-operating-guide.pdf, 332 pages. |
| Japanese Office Action, dated Oct. 11, 2017, for Application No. 2016-528219, 10 pages. |
| Anonymous, “Microsoft Windows Server 2008R2 Directory Services (DS) on Amazon EC2,” Oct. 21, 2012, retrieved on May 10, 2017, from internet at https://web.archive.org/web/20121021194026/https://awsmedia.s3.amazonaws.com/pdf/EC2_AD_How_to.pdf, 8 pages. |
| Canadian Notice of Allowance for Patent Application No. 2,930,253 dated Dec. 7, 2017, 1 page. |
| Canadian Office Action for Patent Application No. 2,930,255 dated Apr. 16, 2018, 5 pages. |
| Canadian Office Action for Patent Application No. 2,930,281 dated Nov. 23, 2017, 6 pages. |
| Canadian Office Action for Patent Application No. 2,930,292 dated Feb. 9, 2018, 4 pages. |
| European Communication pursuant to Article 94(3) EPC dated Apr. 17, 2018, for Application No. 14859670.3, 3 pages. |
| Japanese Final Rejection, dated Dec. 18, 2017, for Patent Application No. 2016-528232, 6 pages. |
| Japanese Patent Application No. 2016-528217, Decision to Grant a Patent, dated Jan. 15, 2018, filed Nov. 10, 2014, 6 pages. |
| Chinese Notice of Grant for Patent Application No. 201480068869.8 dated Mar. 14, 2019, 4 pages. |
| European Search Report dated Feb. 22, 2019, for Patent Application No. EP18204451, 9 pages. |
| Anonymous, “AWS Identity and Access Management Using IAM,” dated Jun. 20, 2013, retrieved on Feb. 12, 2019 from https://web.archive.org/web/20130620090425if_/http://awsdocs.s3.amazonaws.com/IAM/latest/iam-ug.pdf, 219 pages. |
| Chinese Notice of Grant for Patent Application No. 201480068732.2 dated Mar. 15, 2019, 4 pages. |
| Canadian Notice of Allowance for Patent Application No. 2,930,255 dated Apr. 2, 2019, 1 page. |
| Chinese Second Office Action for Patent Application No. 201480072547.0, dated Feb. 11, 2019, 12 pages. |
| Canadian Notice of Allowance for Patent Application No. 2,930,292 dated Feb. 1, 2019, 1 page. |
| Canadian Office Action, dated Oct. 22, 2018, for Patent Application No. 2,930,281,4 pages. |
| Chinese First Office Action for Patent Application No. 201480068648.0 dated Dec. 12, 2018, 8 pages. |
| Chinese Second Office Action for Patent Application No. 201480068732.2 dated Nov. 21, 2018, 7 pages. |
| European Communication under Rule 71(3) EPC for Application No. 14859670.3, Intention to Grant, dated Jan. 3, 2019, 58 pages. |
| Japanese First Office Action for Patent Application No. 2016-528217 dated Feb. 2, 2019, 5 pages. |
| Chinese First Office Action for Patent Application No. 201480068732.2 dated Jun. 15, 2018, 12 pages. |
| Chinese First Office Action for Patent Application No. 201480068869.8 dated Jun. 27, 2018, 12 pages. |
| Chinese First Office Action for Patent Application No. 201480072547.0 dated Jul. 2, 2018, 16 pages. |
| European Communication Under Rule 71(3) EPC for Application No. 14860094.3, Intention to Grant, dated Jul. 5, 2018, 57 pages. |
| European Communication under Rule 71(3) EPC for Application No. 14860654.4, Intention to Grant, dated Jul. 16, 2018, 149 pages. |
| European Communication under Rule 71(3) EPC for Application No. 14861058.7, Intention to Grant, dated Jun. 29, 2018, 55 pages. |
| Japanese Decision to Grant dated Jun. 11, 2018 for Patent Application No. 2016-528232, 6 pages. |
| Japanese Decision to Grant for Patent Application No. 2016-528219 dated Aug. 20, 2018, 6 pages. |
| Chinese Second Office Action dated Jun. 25, 2019, for Patent Application No. 201480068648.0, 9 pages. |
| Japanese Notice to Grant, dated Jul. 8, 2019, for Patent Application No. 2018-073523, 6 pages. |
| Japanese Office Action, dated Jun. 17, 2019, for Patent Application No. 2018-073523, 3 pages. |
| Number | Date | Country | |
|---|---|---|---|
| 61902790 | Nov 2013 | US |
